So let's go back into our environment.
We'll first look at how we can query local computer networking information,
and then we'll look at how we can query and retrieve network traffic.
Now one of the other things that you often want to do,
especially during some type of forensics, was the ability to retrieve
network information specifics around the local network,
as well as traffic going backwards and forwards to those devices.
Now the first thing we can do here is utilize some commands.
So, for example, we have Get‑NetAdapterStatistics.
We also have, if I get rid of that, we have just the NetAdapter,
which if I click Enter will just list the specific adapters,
and of course, our adapter that we're going to utilize is Ethernet0.
So if I go back to my Statistics here, I can say ‑Name "Ethernet0",
and you'll see it's going to show me the Received and the
SentBytes going backwards and forwards,
so I'm able to at least see the amount of traffic
that's going backwards and forwards.
Now we can also go a little bit further here and we can say,
well let's take those values, let's format it, and what I want to do is
see every single property that's available to me.
Now notice this, we get all the details about the property for Ethernet0.
So I get the Description, the ElementName,
I get the traffic Received and the Sent,
I get the UnicastPackets,
and I get the CimClasses that can be utilized for connecting to it,
which we haven't really touched on,
but the CimClasses are a different way of connecting to the machines.
So let me just clear that down here.
So what I can do is utilize that Get‑NetAdapter option and I could say ‑Name *,
which will give me everything.
But, obviously, we can also do by the name itself if we know it.
We can also do ‑IncludeHidden,
which you'll notice there are some that are hidden.
Some of these are often tunneling or built‑in adapters that you can see.
We can also go through and specify,
if I just loop through my commands for a second,
and if I do the ‑Property *, obviously, it's going to bring me,
let me just change Statistics here, because we don't want to call that one,
we want to do Get‑NetAdapter,
and this will give me all of the properties that are associated directly to the
network adapter on the current machine that we're utilizing,
so all of the LinkSpeeds, the Drivers,
and other properties that you might utilize.
Now, of course, that's great,
but obviously if you're already on the machine you could
potentially just look within Windows for that.
Now what about if we wanted to do that remotely?
Well, first off, let me just look at the session that we have created,
this was created previously,
but what about if we try a different type of connection?
So I'm going to say session2 =,
and we're going to use a different command called CimSession.
Now CimSession is a different approach to connecting to machines.
So I'm going to say ‑ComputerName.
Now, of course,
notice it comes back and says access denied because I
didn't pass any credentials with it.
So I'm going to say $cred $session2,
and I now have what's referred to as a CimSession.
Now notice the properties here.
The protocol is WSMAN, and if I do $session here, it's also WSMAN,
but one is connected differently to the other,
but it's to the same machine, so I have two sessions.
What this means is that I can say Get‑NetAdapter like so,
‑Name *,
and then there's a CimSession property which lets me utilize that same session.
And, of course, now I don't have to go onto the session,
enter PSSession and then run the command there,
I can run it remotely from here, but push the command down the CimSession.
So now I'm able to retrieve that there's an Ethernet0 on the
server that we're connecting, which means if I look at previous
commands that we've actually ran, then of course I can say Format‑List,
and I'll say ‑Property *.
So that's going to get me all of the information of the network
adapter on the other machine pulled through the CimSession, and
then present that information to me.
So a very powerful option, and an important one,
especially when you're trying to find out if network adapter changes were made
or if there are hidden network adapters or things like that,
because often people will put VPN‑type things that are there too.
So obviously that's one of the things that we can do,
where we're able to go in and retrieve local network information.
Now,
really what we want to do sometimes is look at the traffic
that's going backwards and forwards.
Now this is all done by using the New‑NetEventSession.
Now, the new EventSession is a session that we create to something,
and we can start and stop the event and we can retrieve the values in between.
So I'm going to call this one Session‑001 and I'm going to say Enter.
So this has now created me a local file.
It's an ETL file, which is an EventTrace.
What I can then do is add a type of EventProvider,
The EventProvider tells them basically what to capture.
So if I say Microsoft‑Windows‑TCPIP, so I want to track TCP/IP values,
I can say ‑SessionName "Session‑001".
So I'm adding a provider to that one to say please capture all of
the IP traffic going backwards and forwards.
Now, nothing's began yet, I'm just setting up what's going on.
You can see the Status is currently set to NotRunning.
So let's change that, let's say Start‑NetEventSession.
And, of course,
we can do a ‑Name to make sure that we only start the specific session.
So our session has been started.
I can then say Get‑NetEventSession, and I have the ‑Name option again,
so I can say Session‑001, and you'll see there's the details in a specific file.
So we have this C:/Windows, so I'm just going to go ahead and copy that,
because I will need that later.
I'm now going to Stop my NetEventSession,
‑Name "Session‑001",
and then I'm going to remove that NetEventSession that
we created so it's not hanging about.
Always, always, always get into a good practice of,
especially when using PowerShell,
that you create objects and then you remove the objects to clear things down.
Okay, So now that we have that one, what can we do with that file?
Well, of course, we have this ETL file,
which means I can now start to retrieve value.
So I'm going to create an option called $log.
I'm going to say Get‑WinEvent, and this time I'm not going to say system,
I'm actually just going to paste that specific one in
there and say get me the oldest.
And when I say log,
you'll see it's got a whole bunch of options which are just network traffic,
so TCP connections.
So this creates us a static file in that log entry to that ETL
file for all of the options that are there.
Now if we don't want to just run it or just open it, we can actually say
$log.Where, and then I can start to query and say _.id eq,
let's say 1001 as a random one that's there, and I can do Enter. Now, of course,
if that value doesn't exist, then of course it's not going to bring back, but if
we go back to log, you can see I can pick 1454,
so let's change that, 1454, and then of course I return those values back.
I can also then start to retrieve specific property values.
So I could say I've got retrieve that one, and then maybe I'm going to say
get me the first one, and then I'm going to say get me the Message, and it
brings back that very first message that's there.
And of course what's nice here is we can also, if we are
using multiple providers that we added, we could say $log, pipe the values out,
we could say Where‑Object, and then I'm not going to go through and type all of
this here, but we can say $_.providerName ‑eq, and then we get to type that
name, which was Microsoft Windows TCP. Of course, if we're using a single one,
it doesn't really make any difference.
But the most important thing here is the ability for you to export as well.
So we can say $log Export‑Csv, and then let's say I want to use that full path,
but I'm going to say csv, like so, set my ‑Delimiter like so,
and then it will export to that location.
So now we created a CSV file. And if I just happened to do the Run command here,
paste that in and Enter, oh, I'm not running as an administrator,
so I'll need to run that one from here.
(Typing) Okay, and then do directory,
you'll see there's my original ETL file and there's my CSV
file. So now we can export those values and utilize them in
other applications as needed.